Cybersecurity-Projects/PROJECTS/beginner/canary-token-generator/infra/docker/canary.prod

49 lines
1.2 KiB
Plaintext

# =============================================================================
# ©AngelaMos | 2026
# canary.prod
# =============================================================================
# Multi-stage build:
# Stage 1 (builder) golang:1.25-alpine, CGO_ENABLED=0, trimpath, ldflags
# Stage 2 (final) gcr.io/distroless/static:nonroot — no shell, non-root
#
# Build context: ./backend (set by compose.yml)
# Result: /canary single static binary, runs as nonroot user.
# =============================================================================
FROM golang:1.25-alpine AS builder
RUN apk add --no-cache ca-certificates git
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build \
-trimpath \
-ldflags="-s -w" \
-o /out/canary \
./cmd/canary
RUN CGO_ENABLED=0 GOOS=linux go build \
-trimpath \
-ldflags="-s -w" \
-o /out/healthcheck \
./cmd/healthcheck
FROM gcr.io/distroless/static:nonroot AS final
WORKDIR /
COPY --from=builder /out/canary /canary
COPY --from=builder /out/healthcheck /healthcheck
COPY --from=builder /src/config.yaml /config.yaml
EXPOSE 8080
USER nonroot:nonroot
ENTRYPOINT ["/canary"]
CMD ["-config", "/config.yaml"]